2

Using Windows Server 2003 active directory with multiple domains in separate forests (using two-way trusts) is there any way I can create a group on one domain that includes users from another domain?

For example:

CENTRAL domain users:
CENTRAL\Alice
CENTRAL\Bob

BRANCH Domain Users:
BRANCH\Carol
BRANCH\Dave

There is a two-way trust between BRANCH and CENTRAL, but they are not in the same forest.

Is there any way to make a group in the CENTRAL domain that includes all four users? When I tried this I found that the membership properties of the group only let me search for users in the CENTRAL domain.

2 Answers 2

3

If you use a DOMAIN LOCAL group, you'll be able to add the users from both domains to the one group.

Better still, add a Global/Universal group from the BRANCH domain (and the same from the CENTRAL domain) to the Domain Local group:

CENTRAL DOMAIN
SPECIAL GROUP
CENTRAL\Alice
CENTRAL\Bob

BRANCH DOMAIN
SPECIAL GROUP
BRANCH\Carol
BRANCH\dave

CENTRAL DOMAIN
JOINT DOMAIN LOCAL GROUP
CENTRAL\Special Group
BRANCH\Special Group

That way, adding new members to the JOINT group just means adding them to the global group within their domain.

2
  • Perfect. Somewhat counter-intuitive to use the group type named "local" to be able to include remote onjects, but exactly what I needed.
    – DrStalker
    Jul 6, 2009 at 6:56
  • That was very clearly put, could you go to work at Microsoft writing documentation, please? Jul 6, 2009 at 13:07
1

Yes the "global" and "local" naming of groups refers to where they can be used, not what they can contain.

Also insert usual replication disclaimer about universal groups here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .